Trojan.Starman.6604

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1148 -dm 7 7 %TEMP%\WER9b0e.dir00\svchost.exe.mdmp 16325836412030176

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%TEMP%\WER9b0e.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe

Сетевая активность:

Подключается к:

'64.##6.199.240':139
'64.##6.155.10':139
'64.##6.58.72':139
'64.#96.1.44':139
'64.##6.30.80':139
'64.#96.70.3':139
'64.##6.32.159':139
'64.##6.60.197':139
'64.##6.85.164':139
'64.##6.197.84':139
'64.##6.173.208':139
'64.##6.239.172':139
'64.##6.136.202':139
'64.##6.245.54':445
'64.##6.137.72':139
'64.##6.255.113':139
'64.##6.104.213':139
'64.##6.128.193':139
'64.##6.45.239':139
'64.##6.109.45':139
'64.##6.125.219':139
'64.##6.38.247':139
'64.##6.239.42':139
'64.##6.218.11':139
'64.##6.199.121':139
'64.##6.54.134':139
'64.##6.211.157':139
'64.##6.200.212':139
'64.##6.15.241':139
'64.##6.145.101':139
'64.##6.133.221':139
'64.##6.39.124':139
'64.##6.16.188':139
'64.##6.84.81':139
'64.##6.63.111':139
'64.##6.109.253':139
'64.##6.14.230':139
'64.##6.102.78':139
'64.##6.26.138':139
'64.##6.69.102':139
'64.##6.86.73':139
'64.##6.131.9':445
'64.##6.130.248':445
'64.##6.56.22':445
'64.##6.99.168':445
'64.##6.162.113':445
'64.##6.93.173':445
'64.##6.140.222':445
'64.##6.251.223':445
'64.##6.7.246':445
'64.##6.167.55':445
'64.##6.89.99':445
'64.##6.197.87':445
'64.##6.139.197':445
'64.##6.183.70':445
'64.##6.234.211':445
'64.#96.44.4':445
'64.##6.69.119':445
'64.##6.89.176':445
'64.##6.181.190':445
'64.##6.19.122':445
'64.##6.20.55':445
'64.##6.232.251':445
'64.##6.71.39':445
'64.##6.9.123':139
'64.##6.31.119':445
'64.##6.210.162':445
'64.##6.13.246':445
'64.##6.9.123':445
'64.##6.225.37':445
'64.##6.245.54':139
'64.##6.225.37':139
'64.##6.131.9':139
'64.##6.171.216':445
'64.##6.131.41':445
'64.##6.216.232':445
'64.##6.240.119':445
'64.##6.227.233':445
'64.##6.103.5':445
'64.##6.131.250':445
'64.##6.117.24':445
'64.##6.70.70':445
'64.##6.202.237':445
'64.##6.51.117':139
'64.##6.79.172':139
'64.##6.99.26':139
'64.##6.107.164':445
'64.##6.40.242':445
'64.##6.79.172':445
'64.##6.205.3':445
'64.##6.51.117':445
'64.##6.205.3':139
'64.##6.99.26':445
'64.##6.211.157':445
'64.##6.200.212':445
'64.##6.15.241':445
'64.##6.145.101':445
'64.##6.133.221':445
'64.##6.200.104':445
'64.##6.34.52':445
'64.##6.186.71':445
'64.##6.76.55':445
'64.##6.217.1':445
'64.##6.184.104':139
'64.##6.61.113':139
'64.##6.243.85':139
'64.##6.129.230':139
'64.##6.12.178':139
'64.##6.230.65':139
'64.##6.40.178':139
'64.##6.48.245':139
'64.##6.31.27':139
'64.##6.18.236':139
'64.##6.72.165':139
'64.#96.8.56':139
'64.#96.30.7':139
'64.##6.203.159':139
'64.##6.70.68':139
'64.##6.159.130':139
'64.##6.55.170':139
'64.##6.214.129':139
'64.##6.183.4':139
'64.#96.25.5':139
'64.##6.171.172':139
'64.##6.239.42':445
'64.##6.128.193':445
'64.##6.255.113':445
'64.##6.109.45':445
'64.##6.239.172':445
'64.##6.45.239':445
'64.##6.58.72':445
'64.##6.199.240':445
'64.##6.30.80':445
'64.##6.104.213':445
'64.#96.1.44':445
'64.##6.200.104':139
'64.##6.34.52':139
'64.##6.186.71':139
'64.##6.76.55':139
'64.##6.217.1':139
'64.##6.136.202':445
'64.##6.173.208':445
'64.##6.137.72':445
'64.##6.107.164':139
'64.##6.40.242':139
'64.##6.155.10':445
'64.##6.26.138':445
'64.##6.102.78':445
'64.##6.69.102':445
'64.##6.16.188':445
'64.##6.86.73':445
'64.##6.218.11':445
'64.##6.38.247':445
'64.##6.54.134':445
'64.##6.14.230':445
'64.##6.199.121':445
'64.#96.70.3':445
'64.##6.32.159':445
'64.##6.60.197':445
'64.##6.85.164':445
'64.##6.197.84':445
'64.##6.84.81':445
'64.##6.39.124':445
'64.##6.109.253':445
'64.##6.125.219':445
'64.##6.63.111':445
'64.##6.186.234':445
'64.##6.175.177':445
'64.##6.26.208':445
'64.##6.140.27':445
'64.##6.208.104':445
'64.##6.138.4':445
'64.##6.45.83':445
'64.##6.124.47':445
'64.##6.224.104':445
'64.##6.171.144':445
'64.##6.41.205':445
'64.##6.119.250':139
'64.##6.177.119':139
'64.##6.30.218':139
'64.##6.239.229':139
'64.##6.59.247':139
'64.##6.66.248':139
'64.##6.231.140':445
'64.#96.1.4':139
'64.##6.184.177':139
'64.##6.173.141':139
'64.##6.16.106':445
'64.##6.73.61':445
'64.##6.228.36':445
'64.##6.14.106':445
'64.##6.145.97':445
'64.##6.186.225':445
'64.##6.18.249':445
'64.##6.155.116':445
'64.##6.131.3':445
'64.##6.115.185':445
'64.##6.187.245':445
'64.##6.111.188':445
'64.##6.213.252':445
'64.##6.18.45':445
'64.##6.246.140':445
'64.##6.236.173':445
'64.#96.70.0':445
'64.##6.137.204':445
'64.##6.123.90':445
'64.##6.43.168':445
'64.##6.92.236':445
'64.##6.229.156':139
'64.##6.236.173':139
'64.##6.18.45':139
'64.##6.246.140':139
'64.##6.124.47':139
'64.##6.16.106':139
'64.##6.123.90':139
'64.##6.92.236':139
'64.##6.43.168':139
'64.##6.111.188':139
'64.##6.213.252':139
'64.##6.138.4':139
'64.##6.231.140':139
'64.##6.140.27':139
'64.##6.26.208':139
'64.##6.208.104':139
'64.##6.224.104':139
'64.##6.45.83':139
'64.##6.41.205':139
'64.##6.175.177':139
'64.##6.171.144':139
'64.#96.70.0':139
'64.##6.254.70':139
'64.##6.232.75':139
'64.##6.196.202':139
'64.##6.155.116':139
'64.##6.33.100':139
'64.##6.153.152':139
'64.##6.253.84':139
'64.##6.177.230':139
'64.##6.16.205':139
'64.##6.231.16':139
'64.##6.14.106':139
'64.##6.73.61':139
'64.##6.186.225':139
'64.##6.137.204':139
'64.##6.145.97':139
'64.##6.131.3':139
'64.##6.18.249':139
'64.##6.187.245':139
'64.##6.228.36':139
'64.##6.115.185':139
'64.##6.140.222':139
'64.##6.227.233':139
'64.##6.7.246':139
'64.##6.167.55':139
'64.##6.89.99':139
'64.##6.216.232':139
'64.##6.171.216':139
'64.##6.232.251':139
'64.##6.240.119':139
'64.##6.251.223':139
'64.##6.69.119':139
'64.##6.89.176':139
'64.##6.20.55':139
'64.##6.19.122':139
'64.##6.181.190':139
'64.##6.130.248':139
'64.##6.56.22':139
'64.##6.99.168':139
'64.##6.162.113':139
'64.##6.93.173':139
'64.##6.131.41':139
'64.##6.15.88':445
'64.##6.188.104':445
'64.##6.104.18':445
'64.##6.22.142':445
'64.##6.231.103':445
'64.##6.216.147':445
'64.##6.212.40':445
'64.##6.191.97':445
'64.##6.187.28':445
'64.##6.92.161':445
'64.##6.103.5':139
'64.##6.131.250':139
'64.##6.117.24':139
'64.##6.70.70':139
'64.##6.202.237':139
'64.##6.71.39':139
'64.##6.91.67':445
'64.##6.31.119':139
'64.##6.210.162':139
'64.##6.13.246':139
'64.##6.139.197':139
'64.##6.119.250':445
'64.##6.177.119':445
'64.##6.30.218':445
'64.##6.239.229':445
'64.##6.59.247':445
'64.##6.66.248':445
'64.##6.232.75':9988
'64.#96.1.4':445
'64.##6.184.177':445
'64.##6.173.141':445
'64.##6.232.75':445
'64.##6.16.205':445
'64.##6.254.70':445
'64.##6.33.100':445
'64.##6.196.202':445
'64.##6.153.152':445
'64.##6.229.156':445
'64.##6.253.84':445
'64.##6.231.16':445
'64.##6.177.230':445
'64.##6.43.168':9988
'64.##6.216.147':139
'64.##6.212.40':139
'64.##6.191.97':139
'64.##6.92.161':139
'64.##6.187.28':139
'64.##6.183.70':139
'64.##6.197.87':139
'64.#96.44.4':139
'64.##6.234.211':139
'64.##6.186.234':139
'64.##6.184.177':9988
'64.##6.91.67':139
'64.##6.30.218':9988
'64.##6.111.188':9988
'64.##6.124.47':9988
'64.##6.15.88':139
'64.##6.188.104':139
'64.##6.231.103':139
'64.##6.22.142':139
'64.##6.104.18':139

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней